#example /robots.txt
User-agent: *
Disallow: /guestbook #guestbook is the most attacked folder. even if you never have it and never links it, spambot will try to access it
Disallow: /cgi-bin/guestbook.cgi #your guestbook.cgi should be replaced with spambot trap
Disallow: /emailaccounts #use scripts to poison spambot with thousands/millions of fake email addresses
Disallow: /anothertrap
Disallow: /moretrap

.htaccess

combined with robots.txt to trap and block bad bots ip addresses.

check referer. use redirect if access to POST your form is not from your own web.